What does Commission guidelines on the AI system definition say about AI in banking?

What are the key points of Commission guidelines on the AI system definition?

• Status and date: published 6 February 2025 as the approved draft Communication C(2025) 924; the formally adopted Communication is C(2025) 5053 of 29 July 2025. Paragraph 7: the Guidelines are not binding and only the CJEU can give an authoritative interpretation.
• Seven elements of the Article 3(1) definition (paragraph 9): machine-based system; varying levels of autonomy; possible adaptiveness after deployment; explicit or implicit objectives; inference of how to generate outputs; outputs such as predictions, content, recommendations or decisions; influence on physical or virtual environments.
• Inference is the key criterion (paragraphs 26-45): it covers machine-learning approaches (supervised, unsupervised, self-supervised, reinforcement and deep learning) and logic- and knowledge-based approaches; the Guidelines name fraud detection systems trained on labelled transaction data as a supervised-learning example (paragraph 34).
• Excluded by the Commission's reading (paragraphs 41-51): systems for improving mathematical optimisation, including 'linear or logistic regression methods' that do not 'transcend basic data processing' (paragraph 42); basic data processing following fixed human-programmed rules (paragraph 46); classical heuristics; and simple prediction systems based on basic statistical rules such as a historical average (paragraphs 49-51).
• Autonomy (paragraphs 14-21): a system with some degree of independence of action from human involvement is autonomous; a system that needs full manual involvement or is exactly specified by a human does not meet the element.
• Paragraph 61-62: the assessment must follow the specific architecture and functionality of each system; no automatic determination or exhaustive list of in-scope or out-of-scope systems is possible.
• Paragraph 63: only certain AI systems face regulatory obligations; the vast majority, even if they qualify as AI systems, are not subject to any requirement of the AI Act, which reaches prohibited practices (Article 5), high-risk systems (Article 6) and the transparency duties of Article 50.
• The Guidelines were adopted in parallel with the Commission's guidelines on prohibited AI practices, and the definition applied from 2 February 2025 together with Chapters I and II of the Act (paragraph 4).

What did Commission guidelines on the AI system definition change for banks?

The Act's definition is broad and deliberately technology-neutral, and banks had no way to tell whether long-established scorecards and statistical models counted. The Guidelines give a partial answer: well-established regression-based optimisation and fixed-rule software sit outside the definition, while machine-learning models that infer from data are inside it. That matters most for Annex III credit-scoring and creditworthiness systems, where being inside or outside the definition decides whether the high-risk regime applies, and the EIOPA opinion on AI governance applies the same definition and paragraph 42 for insurers.

How do the Commission guidelines define an AI system, and which bank models fall outside it?

The Commission's Guidelines on the definition of an AI system, published on 6 February 2025 and adopted as C(2025) 5053 on 29 July 2025, read Article 3(1) of the AI Act as seven elements, of which inference — generating predictions, content, recommendations or decisions from input — is the one that separates AI from ordinary software. They exclude systems built on well-established optimisation methods such as linear or logistic regression that do not go beyond basic data processing, fixed-rule software and simple statistical predictors, but they say that no list is exhaustive and each system must be assessed individually. For a bank, a machine-learning credit, fraud or chatbot system is presumptively an AI system; a legacy rule-based scorecard may not be, but the conclusion has to be documented.

The Guidelines sit beneath the AI Act itself (Regulation (EU) 2024/1689) and were adopted in parallel with the Commission's guidelines on prohibited practices. They do not create obligations; they show how the Commission and the national market surveillance authorities are likely to read the definition, and the EIOPA opinion on AI governance explicitly relies on them and quotes paragraph 42.

The practical edge for banks is the boundary around statistical models. Credit scorecards built on logistic regression are the classic example: the Commission's text puts well-established regression-based optimisation outside the definition, but it also stresses the system-by-system test. A scorecard that is retrained automatically, uses unstructured data, or is combined with a machine-learning component is a different case from a static, long-used model.

Being in scope of the definition is distinct from being high-risk. Whether a system is in Annex III depends on its use, and the deadline for standalone Annex III systems was moved to 2 December 2027 by Regulation (EU) 2026/1744.

WHAT THIS MEANS IN PRACTICE

• Run the seven-element test as a documented step in the model inventory for every model used in credit, fraud, AML, pricing and customer service, and record the outcome and reasoning.
• Where a model is classed as out of scope on the basis of paragraph 42 or 46, keep evidence that it has no self-learning, adaptive or non-rule-based component and has been used in a consolidated manner.
• Treat vendor models by the same test; ask vendors to state whether their product is an AI system within Article 3(1).
• Reassess when a model is retrained on new data, replaced, or combined with machine-learning components, since the classification can change.
• Remember that out-of-scope models still fall under model risk rules such as SR 11-7 and PRA SS1/23 and, in the EU, the CRR and EBA guidelines.